Dexcom data breach lawsuits (2026)

Dexcom, Inc., the San Diego company that makes continuous glucose monitors for people with diabetes, faces at least nine proposed class action lawsuits over a cybersecurity incident it disclosed on October 10, 2026. All nine were filed in the U.S. District Court for the Southern District of California between October 2 and October 14, 2026.

The suits say patients' and customers' personal and health information was taken. Dexcom has confirmed "unauthorized access to limited information from certain internal documents" and says its products were not affected. It has not said publicly how many people were affected or what kinds of information were involved. No court has ruled on the claims, and there is no settlement.

Dexcom is a Delaware corporation with its principal place of business in San Diego. It makes continuous glucose monitoring systems, wearable sensors that measure glucose levels and send readings to a phone app or receiver. The Hart complaint, citing Dexcom's website, says the company has more than 2.8 million active customers in over 100 countries.

The plaintiffs who filed the complaints reviewed for this article include:

• Richard Lovell, an Indiana resident, represented by Levi & Korsinsky (No. 3:26-cv-05699, filed October 5).
• Mark Allen Hunter, an Oregon resident who says he has used Dexcom glucose monitoring since about 2013 and shares data with his doctors through Dexcom Clarity and Tidepool, represented by Wilshire Law Firm (No. 3:26-cv-05727, filed October 6).
• Donovan Hart of Temecula, California, who describes himself as a former consumer of Dexcom devices, represented by Emery Reddy (No. 3:26-cv-05851, filed October 13).

The court's docket shows six more suits: Brigando (October 2), Loginov, Spruell and Slepr (October 13), and Hutchinson and Rigney (October 14). Class Action Pulse has not reviewed those six complaints.

On or about October 1, 2026, according to the Lovell complaint and Cybernews, the hacking group ShinyHunters listed Dexcom on its data-leak website and claimed to have taken company data. Cybernews reported that the listing did not include data samples. The group's claims have not been verified.

On October 10, 2026, Dexcom posted a statement saying it had "identified a cybersecurity incident that resulted in unauthorized access to limited information from certain internal documents following targeted vishing events." Vishing means phone calls in which someone pretends to be a trusted person to obtain passwords or access. Dexcom said it engaged a cybersecurity forensics firm, contained the incident and added security measures.

Several suits were filed before that statement. The Lovell complaint says that, as of its filing on October 5, Dexcom had not publicly disclosed the incident.

The plaintiffs allege that Dexcom failed to use reasonable security for sensitive data. The Lovell and Hart complaints allege, on information and belief, that the exposed information may include names, dates of birth, driver's license numbers, financial information, medical records and health insurance information. The Hart complaint also alleges the data was published on the dark web. The Hunter complaint alleges that identifying information linked to medical and device-support records was taken and estimates that at least tens of thousands of consumers were affected. These are allegations based on counsel's investigations, not confirmed facts.

The claims include negligence, breach of implied contract and unjust enrichment. Hunter also sues under California's Confidentiality of Medical Information Act and Oregon's Unlawful Trade Practices Act.

Dexcom's October 10 statement says "there is no impact on our products, operations, or our ability to meet the needs of our customers and partners." It says the company will keep stakeholders informed, "including notifying any impacted individuals where appropriate." Dexcom had not answered any complaint in court as of October 17, 2026.

The court has not decided anything about these claims. It has not ruled on whether Dexcom was negligent, whether any customer data was taken, whether the cases will be consolidated, or whether a class will be certified. When several similar suits are filed in the same court, judges often combine them and appoint lead lawyers, but no such order had been found as of October 17, 2026.

Each complaint proposes its own class. Lovell proposes all persons in the United States whose private information was compromised in the breach. Hunter proposes all U.S. residents whose information, kept in connection with Dexcom's consumer products, apps or services, was accessed or taken, plus an Oregon subclass. Hart proposes all U.S. residents whose information was compromised in the breach Dexcom discovered in October 2026, including people who receive notice. Hart's complaint describes Dexcom as holding data about consumers and employees.

Dexcom and people tied to it are excluded under each definition. No class has been certified, and nobody knows yet who was affected.

Watch your mail and email for a breach notice from Dexcom. Dexcom says it will notify impacted individuals where appropriate. If you receive one, keep it, because notice may later help show you belong in a class.

Be cautious with calls, texts or emails that claim to be from Dexcom and ask for passwords, payment details or account codes. Check your health insurance statements and credit reports for activity you do not recognize. Readers can contact the filing firms or their own lawyer. Contacting a firm does not make you a client, and an inquiry through Class Action Pulse does not join any lawsuit.

Nothing is available now. The complaints ask for damages, statutory damages where available, restitution, attorneys' fees and court orders requiring better security. Hart also asks for punitive damages. Hunter asks for nominal damages, punitive damages on his Oregon claim and an order requiring Dexcom to identify and give notice of the compromised records. Any payment would require a court judgment or an approved settlement.

• About October 1 to 3, 2026: ShinyHunters lists Dexcom on its leak site, according to the complaints and Cybernews.
• October 2, 2026: First suit, Brigando, is filed.
• October 10, 2026: Dexcom posts its cybersecurity statement.
• October 14, 2026: Hutchinson and Rigney suits filed, bringing the total to at least nine.

There is no claim deadline. Opt-out and objection rights would arise only after certification or a proposed settlement.

A data breach is unauthorized access to stored personal information. Protected health information is health data linked to a person, such as medical records or insurance details. Vishing is voice phishing by phone. Consolidation means combining similar lawsuits into one case. Class certification is a court order allowing named plaintiffs to sue for a larger group.

Dexcom may move to consolidate the suits or ask for one coordinated schedule. A judge could then appoint interim lead counsel and set a deadline for a single amended complaint. Dexcom's breach notices, if sent, would show how many people were affected and what data was involved.

A practical note: a breach notice usually includes an enrollment code for any free credit monitoring offered. Keep the letter or email even if you do not enroll.

The Lovell, Hunter and Hart complaints support the parties, class definitions, claims and alleged data types. Dexcom's statement supports the company's account. Cybernews supports the leak-site listing. The number of affected people, the data actually taken and whether customers were affected are unconfirmed.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.